Executive brief
A bug in the Linux kernel's OCFS2 cluster heartbeat mechanism causes incorrect tracking of the local node state, leading to memory access violations. When heartbeat operations interact with the node manager during state transitions, the system can read invalid memory addresses, potentially causing kernel crashes or unpredictable behavior in systems using clustered OCFS2 filesystems.
Technical details
The vulnerability is a state management bug in the ocfs2 cluster heartbeat code (fs/ocfs2/cluster/heartbeat.c). When the local node is reset via o2nm_node_local_store(local=0), the cl_has_local flag is not cleared, leaving stale state. Heartbeat threads dynamically read o2nm_this_node() which then returns O2NM_MAX_NODES (255), an invalid node number. Subsequent heartbeat operations in o2hb_do_disk_heartbeat() use this invalid value to access arrays, triggering a KASAN slab-out-of-bounds report on memory writes. The fix stores the local node number at heartbeat region startup and uses that stable value throughout the heartbeat lifecycle, clearing both cl_has_local and cl_local_node together during reset. The vulnerability requires local filesystem access and active heartbeat threads.
Affected products
- Linux Linux kernel multiple versions with ocfs2 cluster heartbeat code
Timeline
- 2026-09-17: disclosed: CVE-2026-90322 published
- patched: Fix resolves state management by storing stable local node number in heartbeat region